Windows build script trusts Python.org binaries and non-freedom Visual Studio (msvc, mingw, exe, crt, msvcrt, microsoft, gcc)

[JeremyRand]

The Windows build scripts include this:

electrum/contrib/build-wine/prepare-wine.sh

Lines 54 to 55 in 6cfe822

	download_if_not_exist "$PYTHON_DOWNLOADS/${msifile}.msi" "https://www.python.org/ftp/python/$PYTHON_VERSION/win32/${msifile}.msi"
	download_if_not_exist "$PYTHON_DOWNLOADS/${msifile}.msi.asc" "https://www.python.org/ftp/python/$PYTHON_VERSION/win32/${msifile}.msi.asc"

This is downloading Python binaries from Python.org. Those binaries are probably not reproducible, and they are built with a non-freedom compiler (Visual Studio 2017 AFAIK). It would be better to use Python binaries for Windows that are reproducibly cross-compiled from GNU/Linux.

Would a PR be accepted that does this?

[SomberNight]

Yes, of course.

[SomberNight]

some related links:
https://matthew-brett.github.io/pydagogue/mingw_python.html
https://bugs.python.org/issue4709
https://github.com/msys2/MINGW-packages/tree/master/mingw-w64-python (snapshot)

Note that if we built python using mingw, the prebuilt windows wheels provided on PyPI for some of our dependencies might not work with that anymore - in which case we would have to rebuild those using mingw too.

In any case, if we could avoid using pre-built wheels and build our dependencies from source instead, that would be a huge win. To me personally, that looks even more important than building python ourselves -- I am inclined to trust CPython builds from python.org more than binary wheels from PyPI for our python dependencies.